# Can give a examplge about how logstash use udp data to es? **URL:** \ **Category:** Logstash\ **Created:** [March 13, 2018, 1:26am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661 "2018-03-13T01:26:49Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 13, 2018, 1:26am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/1 "2018-03-13T01:26:49Z")
can give a example about use udp data ? how configure logstash with udp data as port 3232 input dat from as port 3242 , how filter configure how output to es configure. give me a example it's about the .conf file setting with logstash. thanks so much ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 13, 2018, 6:41am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/2 "2018-03-13T06:41:37Z")
What have you tried so far? ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 13, 2018, 7:16am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/3 "2018-03-13T07:16:06Z")
how the filter settings about grok match ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 13, 2018, 7:47am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/4 "2018-03-13T07:47:35Z")
You have not shown what you have tried nor what the data received looks like, so I am not sure how I can help. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 8:35am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/5 "2018-03-15T08:35:44Z")
@Christian_Dahlqvist the data link this `1521102697403000002|!xxx|!11.xx.xx.ipv4|! |! |!1521102697021|!1521102697403|!xx.xx.xxx.xxx|!|!4|!61894|!xx.xx.xxx.ipv4|!|!4|!531|!xx.xx.xx.ipv4|!514|!EE:FF:FF:FF:FF:FF|!MACADD|!24|!tcp|!xxx|!17=0 18=0 19=0 20=0 21=0 22=0 23=0 24=0 25=0 26=0 27=0 28=0 29=0 30=0 31=0 32=0 33=11844|! |!` how do it ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 15, 2018, 8:48am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/6 "2018-03-15T08:48:53Z")
This looks like csv formatted data. Why not try a [csv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv) with `|!` as separator? You can the apply a [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) to the field containing `17=0 18=0 19=0 20=0 21=0 22=0 23=0 24=0 25=0 26=0 27=0 28=0 29=0 30=0 31=0 32=0 33=11844` if you want to parse these out as fields too. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 8:51am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/7 "2018-03-15T08:51:11Z")
this is use logstash udp date . not csv file. can give a example about this udp how configure with this data. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 8:54am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/8 "2018-03-15T08:54:46Z")
> [@zqc0512](#): > > 1521102697403000002 this is time . which patterns can use. @Christian_Dahlqvist ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 15, 2018, 8:57am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/9 "2018-03-15T08:57:47Z")
If the data received over UDP is in csv format (which it looks like), you can use the csv filter to parse it. I do not think you necessarily need to use grok here. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 9:00am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/10 "2018-03-15T09:00:33Z")
OK i try the elastic doc can't open now .😂😂😂😂 can give a CSV example about my data. @Christian_Dahlqvist ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 15, 2018, 9:04am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/11 "2018-03-15T09:04:52Z")
Try something like this: ```auto input { udp { port => 3232 } } filter { csv { columns => ["c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "c10", "c11", "c12", "c13", "c14", "c15", "c16", "c17", "c18", "c19", "c20", "c21", "c22", "c23", "c24", "c25"] separator => "|!" } } output { stdout { codec => rubydebug } } ``` Rename columns as appropriate, the use mutate to cast numbers and a date filter to parse the appropriate timestamp. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 9:06am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/12 "2018-03-15T09:06:30Z")
> [@Christian\_Dahlqvist](#): > > 17=0 18=0 19=0 20=0 21=0 22=0 23=0 24=0 25=0 26=0 27=0 28=0 29=0 30=0 31=0 32=0 33=11844 i this how do about kv? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 15, 2018, 9:10am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/13 "2018-03-15T09:10:02Z")
Look at the docs for details. Something like this might work: ```auto kv { source => "c23" } ``` Not sure the source field is correct... ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 15, 2018, 9:11am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/14 "2018-03-15T09:11:47Z")
yes kv is 23 . how do it 26=0 the 26 is id 0 is value. ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 16, 2018, 12:28am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/15 "2018-03-16T00:28:58Z")
thanks so much . @Christian_Dahlqvist ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [March 16, 2018, 1:29am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/16 "2018-03-16T01:29:21Z")
now in kibana the data is like \_source": { "1": "1", "2": "0", "3": "0", "4": "0", "5": "1", "6": "0", "7": "1", "8": "0", "9": "0", "10": "0", "11": "0", "12": "0", "13": "0", "14": "0", "15": "0", "16": "0", "code": "1=1 2=0 3=0 4=0 5=1 6=0 7=1 8=0 9=0 10=0 11=0 12=0 13=0 14=0 15=0 16=0", how change the "16": "0", to " **testname**": "0", not use the id use the custom name it change in logstash configure file or with es mapping ? how can do it thanks. @Christian_Dahlqvist @warkolm ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 16, 2018, 10:47am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/17 "2018-03-16T10:47:19Z")
I suspect you may need to use a [ruby filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) to change the field names. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2018, 10:47am UTC](https://discuss.elastic.co/t/can-give-a-examplge-about-how-logstash-use-udp-data-to-es/123661/18 "2018-04-13T10:47:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.